topic Re: Highlight Unused Objects Checkbox in General Topics

Highlight Unused Objects Checkbox

charlesk — Tue, 07 Mar 2017 17:45:23 GMT

I am not sure how to go about requesting this formally, but there should be a button for "Highlight unused objects" similar to the checkbox that is on the policy tab for "HIghlight Unused Rules". This would be a HUGE time saver for admins using the shared objects in Panorama and even using a few unique firewalls.

I have really had very little luck trying to see whcih objects are used and which are not. The time that it would take to go through thousands of objects that we have would be futile at best.

Thoughts or maybe information about a future release with this functionality?

Re: Highlight Unused Objects Checkbox

jsalmans — Tue, 07 Mar 2017 17:49:39 GMT

That would probably be a pretty useful feature in the interface.

I also just found this:

https://live.paloaltonetworks.com/t5/Migration-Tool-Discussions/Best-practice-for-object-cleanup/td-p/41514

I personally like the last mention on that thread about using the Migration Tool. You can export a config copy from your firewall and load it up in that... gives you some really nice information even if you're not planning on migrating to anything.

Re: Highlight Unused Objects Checkbox

Brandon_Wertz — Tue, 07 Mar 2017 18:57:46 GMT

I used the migration tool to migrate a CheckPoint config and was able to get rid of > 20k objects and > 600 service objects.

If interested you can also look into another product call FireMon they're compatible with just about every FW vendor and are really a more purpose built tool to do just what the OP is asking for. (Down to the numerical count of the times an object was used in a particular security policy.)

Re: Highlight Unused Objects Checkbox

bradk14 — Tue, 07 Mar 2017 19:07:05 GMT

>gives you some really nice information even if you're not planning on migrating to anything.

this, including the ability to edit multiple policies at once.

Re: Highlight Unused Objects Checkbox

BenjAudy.MTL — Fri, 10 Mar 2017 21:26:10 GMT

A quick and dirty way to know if an object is in use is to delete it. You can click on the first entry and shift click on the last one to select all the objects. If an object is in use, it will not be deleted (an error message will appear). You can then preview the changes to see what is actually not used. Make sure you revert to the running config after doing that! Also, you coworkers might freak out when they see you do that.

Benjamin